Re: [squid-users] Warning

On 30/08/11 08:07, Igor Rafael wrote:
> Hello,
> What might be causing this Warning?!
>
> "WARNING: Forwarding loop detected for:
> Client: 192.168.15.251 http_port: 192.168.15.202:3128"
>

http://wiki.squid-cache.org/SquidFaq/TroubleShooting#What_is_a_forwarding_loop.3F

>
> See my config file :
<snip>
> # Scenario 3. Mesh
> #cache_peer 192.168.15.200 parent 3128 0 no-query round-robin
> cache_peer 192.168.15.253 sibling 3128 3130 no-digest proxy-only
> cache_peer 192.168.15.252 sibling 3128 3130 no-digest proxy-only
> cache_peer 192.168.15.251 sibling 3128 3130 no-digest proxy-only
> #prefer_direct off
> ### END Scenario 3 ###
<snip>
>
> # Basic configuration
> http_port 3128 transparent

It appears that this proxy is configured to perform BOTH of the traffic
operations which can lead to traffic loops.

I highly recommend using two http_port entries. 3128 for sibling
communications and moving the "transparent" to a second randomly chosen
port number. Your NAT settings will need updating to match that port.

  If this is a Linux box there are iptables mangle security rules that
need to be applied as well. Please compare your NAT settings against the
recommended configs:
   http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat
   http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect

Possibly the loop was from a peer. You will need to find out why the
request is coming from this proxy into the peers and back out again
here. And some way to prevent it happening.

   miss_access may be useful, wither here or in the siblings. It
prevents certain requests being relayed through the proxy using it.

>
> acl all src 0.0.0.0/0.0.0.0

Please use "acl all src all" if you have an old Squid. Or remove if this
is a 3.x release.

> icp_access deny all
> http_access allow all

Ouch. VERY unsafe. This is an open proxy. Whatever the firewall
situation around it is. Once that is breached this setup is a gaping
security hole to anywhere.

  I highly recommend creating an ACL of the LAN IPs from which you
accept traffic (ie the default localnet or our_networks definitions) and
changing that "allow all" into "allow localnet"

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.15
   Beta testers wanted for 3.2.0.10